Notification reg Central Government hereby declares the Supervisory Control and Data Acquisition System and Unified Real Time Dynamic State Measurement System

## Policy Analysis Report: Declaration of SCADA and URTDSM Systems as Protected Systems **1. Executive Summary:** This report analyzes a notification from the Ministry of Power, Government of India, declaring the Supervisory Control and Data Acquisition (SCADA) system and Unified Real Time Dynamic State Measurement (URTDSM) system of the State Load Despatch Centre of Damodar Valley Corporation (DVC), Howrah, West Bengal, as Protected Systems under the Information Technology Act, 2000. The core purpose is to enhance the cybersecurity and resilience of critical information infrastructure within the power sector. The key finding is that this designation empowers the government to enforce stricter security measures and legal protections for these vital systems, safeguarding them from potential cyber threats. **2. Introduction:** This report provides an overview and analysis of the Ministry of Power notification S.O. 5851(E), dated December 13, 2022, concerning the declaration of SCADA and URTDSM systems as Protected Systems. The analysis is based solely on the information provided in the official notification text. **3. Policy Overview:** * This is a *new* policy declaration. * **Core Objective(s):** The core objective, as inferred from the text, is to protect the SCADA and URTDSM systems of the State Load Despatch Centre of DVC from cyber threats by designating them as "Protected Systems" under the Information Technology Act, 2000. This aims to ensure the continuous and reliable operation of critical power infrastructure. **4. Background and Rationale:** The policy addresses the increasing threat of cyberattacks targeting critical infrastructure, particularly within the power sector. SCADA and URTDSM systems are essential for monitoring, controlling, and managing electricity grids. Compromising these systems could lead to widespread power outages, economic disruption, and potential safety hazards. By declaring these systems as Protected Systems, the government aims to provide a legal framework for enhanced security measures and incident response capabilities. **5. Key Provisions / Changes:** As a new policy, the key provision is the formal designation of the SCADA and URTDSM systems of the State Load Despatch Centre of DVC as "Protected Systems" under Section 70(1) of the Information Technology Act, 2000. This designation empowers the government to: * Prescribe security practices and procedures for protecting these systems. * Criminalize unauthorized access or damage to these systems. * Provide legal recourse for addressing cybersecurity incidents affecting these systems. * This policy does *not* amend a previous one, it establishes a new protection for designated systems. **6. Target Audience and Stakeholders:** The primary target audience and stakeholders directly affected by this policy include: * **Damodar Valley Corporation (DVC):** As the owner and operator of the SCADA and URTDSM systems, DVC is responsible for implementing and maintaining the required security measures. * **State Load Despatch Centre (SLDC), Howrah, West Bengal:** As the location of the targeted systems, the SLDC is immediately and directly affected by the regulation. * **Ministry of Power:** The notifying agency responsible for enforcing the provisions of the Information Technology Act, 2000, related to protected systems. * **Cybersecurity Professionals:** Those involved in securing critical infrastructure within the power sector, who will need to adapt their strategies to align with the policy requirements. * **Power Industry and Consumers:** While indirectly affected, reliable power supply to industry and consumers is the desired ultimate outcome. **7. Implementation Aspects (Inferred):** * **Responsible agency/bodies:** The Ministry of Power is the responsible agency. DVC will be responsible for implementing security measures. * **Timelines or procedures:** The notification states that it comes into force on the date of its publication in the Official Gazette (December 14, 2022). No specific implementation timelines or procedures are detailed *within the provided text*. **8. Expected Outcomes / Impact of Changes:** The likely intended outcomes of this policy declaration include: * **Enhanced Cybersecurity Posture:** Increased security measures and incident response capabilities for the SCADA and URTDSM systems. * **Reduced Vulnerability to Cyberattacks:** Minimizing the risk of successful cyberattacks that could disrupt power supply. * **Improved Operational Resilience:** Ensuring the continuous and reliable operation of the power grid, even in the event of a cyber incident. * **Legal Deterrent:** Discouraging malicious actors from targeting these critical systems due to the potential legal consequences. **9. Conclusion:** The Ministry of Power's notification declaring the SCADA and URTDSM systems of the DVC State Load Despatch Centre as Protected Systems is a significant step towards strengthening the cybersecurity of critical power infrastructure. By providing a legal framework for enhanced security measures and incident response, this policy aims to safeguard these vital systems from potential cyber threats and ensure the reliable supply of electricity. This designation emphasizes the importance of proactive cybersecurity measures in protecting essential infrastructure and maintaining national security.

Key Entities Referenced